CVE-2026-65606
SiYuan, a note‑taking application, has a critical cross‑site scripting flaw that lets attackers run arbitrary OS commands. The bug is triggered by a specially crafted siyuan:// link that injects JavaScript into the app’s UI. It affects all versions before 3.7.2.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
SiYuan desktop application, versions earlier than 3.7.2, used by users who open custom siyuan:// links.
Real-world impact
An attacker could trick a user into opening a malicious siyuan:// link, causing the application to execute arbitrary commands on the user’s computer, potentially giving the attacker full control.
Why this severity
The CVSS score of 9.4 reflects the vulnerability’s high exploitability (no authentication, low effort) and its severe impact: it allows attackers to run any OS command, compromising confidentiality, integrity, and availability.
What to do about it
- 011. Upgrade SiYuan to version 3.7.2 or later.
- 022. Restart the application.
NVD description
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 9d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.